ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique cryptographic keys during establishing a secure connection(IKE) with the mobile devices connecting over the internet . If the set of keys are leaked or cracked, the user session informations using the keys may be leaked.
Source: ZTE Corporation
Max CVSS
8.3
EPSS Score
N/A
Published
2024-05-10
Updated
2024-05-14
Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro
Source: ZTE Corporation
Max CVSS
6.6
EPSS Score
0.11%
Published
2024-01-04
Updated
2024-02-28
There is a command injection vulnerability of ZTE's ZXCLOUD iRAI. Due to the  program  failed to adequately validate the user's input, an attacker could exploit this vulnerability  to escalate local privileges.
Source: ZTE Corporation
Max CVSS
7.8
EPSS Score
0.04%
Published
2024-01-03
Updated
2024-01-09
There is a DLL hijacking vulnerability in ZTE ZXCLOUD iRAI, an attacker could place a fake DLL file in a specific directory and successfully exploit this vulnerability to execute malicious code.
Source: ZTE Corporation
Max CVSS
4.8
EPSS Score
0.04%
Published
2024-01-05
Updated
2024-01-11
There is a Cross-site scripting (XSS)  vulnerability in ZTE MF258. Due to insufficient input validation of SMS interface parameter, an XSS attack will be triggered.
Source: ZTE Corporation
Max CVSS
6.1
EPSS Score
0.05%
Published
2024-01-10
Updated
2024-01-17
There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Due to the  program  failed to adequately validate the user's input, an attacker could exploit this vulnerability  to escalate local privileges.
Source: ZTE Corporation
Max CVSS
7.8
EPSS Score
0.04%
Published
2024-01-03
Updated
2024-01-09
There is an illegal memory access vulnerability of ZTE's ZXCLOUD iRAI product.When the vulnerability is exploited by an attacker with the common user permission, the physical machine will be crashed.
Source: ZTE Corporation
Max CVSS
5.5
EPSS Score
0.04%
Published
2024-01-03
Updated
2024-01-09
There is a local privilege escalation vulnerability of ZTE's ZXCLOUD iRAI.Attackers with regular user privileges can create a fake process, and to escalate local privileges.
Source: ZTE Corporation
Max CVSS
7.8
EPSS Score
0.04%
Published
2024-01-03
Updated
2024-01-09
There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak.
Source: ZTE Corporation
Max CVSS
8.0
EPSS Score
0.04%
Published
2023-12-14
Updated
2023-12-19
There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user permission could access the download interface by modifying the request parameter, causing arbitrary file downloads.
Source: ZTE Corporation
Max CVSS
6.5
EPSS Score
0.05%
Published
2023-12-14
Updated
2023-12-19
There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.
Source: ZTE Corporation
Max CVSS
8.8
EPSS Score
0.07%
Published
2023-08-25
Updated
2023-08-31
There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Due to weak folder permission, an attacker with ordinary user privileges could construct a fake DLL to execute command to escalate local privileges.
Source: ZTE Corporation
Max CVSS
7.8
EPSS Score
0.04%
Published
2023-12-14
Updated
2023-12-19
There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor the touch event.
Source: ZTE Corporation
Max CVSS
4.7
EPSS Score
0.04%
Published
2023-08-17
Updated
2023-08-24
There is a permission and access control vulnerability in some ZTE AndroidTV STBs. Due to improper permission settings, non-privileged application can perform functions that are protected with signature/privilege-level permissions. Exploitation of this vulnerability could clear personal data and applications on the user's device, affecting device operation.
Source: ZTE Corporation
Max CVSS
7.7
EPSS Score
0.05%
Published
2023-06-16
Updated
2023-06-26
There is a denial of service vulnerability in some ZTE mobile internet products. Due to insufficient validation of Web interface parameter, an attacker could use the vulnerability to perform a denial of service attack.
Source: ZTE Corporation
Max CVSS
7.5
EPSS Score
0.05%
Published
2023-12-14
Updated
2023-12-18
There is a command injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of multiple network parameters, an authenticated attacker could use the vulnerability to execute arbitrary commands.
Source: ZTE Corporation
Max CVSS
8.8
EPSS Score
0.05%
Published
2023-12-14
Updated
2023-12-18
There is a buffer overflow vulnerability in some ZTE mobile internet producsts. Due to insufficient validation of tcp port parameter, an authenticated attacker could use the vulnerability to perform a denial of service attack. 
Source: ZTE Corporation
Max CVSS
6.5
EPSS Score
0.04%
Published
2023-12-14
Updated
2023-12-18
There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could delete some system files without user permission.
Source: ZTE Corporation
Max CVSS
7.1
EPSS Score
0.05%
Published
2023-05-30
Updated
2023-06-07
There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could start a non-public interface of an application without user permission.
Source: ZTE Corporation
Max CVSS
3.3
EPSS Score
0.04%
Published
2023-05-30
Updated
2023-06-07
There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to execute arbitrary commands.
Source: ZTE Corporation
Max CVSS
9.8
EPSS Score
0.10%
Published
2023-01-06
Updated
2023-01-12
There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an authenticated attacker could use the vulnerability to execute stored XSS attacks.
Source: ZTE Corporation
Max CVSS
5.4
EPSS Score
0.05%
Published
2023-01-06
Updated
2023-01-12
There is an unauthorized access vulnerability in some ZTE mobile phones. If a malicious application is installed on the phone, it could overwrite some system configuration files and user installers without user permission.
Source: ZTE Corporation
Max CVSS
7.1
EPSS Score
0.05%
Published
2023-05-30
Updated
2023-06-07
There is an access control vulnerability in some ZTE PON OLT products. Due to improper access control settings, remote attackers could use the vulnerability to log in to the device and execute any operation.
Source: ZTE Corporation
Max CVSS
9.8
EPSS Score
0.35%
Published
2022-11-22
Updated
2022-11-28
There is a SQL injection vulnerability in ZTE ZAIP-AIE. Due to lack of input verification by the server, an attacker could trigger an attack by building malicious requests. Exploitation of this vulnerability could cause the leakage of the current table content.
Source: ZTE Corporation
Max CVSS
5.3
EPSS Score
0.07%
Published
2022-11-08
Updated
2022-11-09
There is a buffer overflow vulnerability in ZTE MF286R. Due to lack of input validation on parameters of the wifi interface, an authenticated attacker could use the vulnerability to perform a denial of service attack.
Source: ZTE Corporation
Max CVSS
6.5
EPSS Score
0.07%
Published
2022-11-22
Updated
2022-11-30
128 vulnerabilities found
1 2 3 4 5 6
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!